Security Awareness Training for NZ Businesses
Help your staff recognise suspicious requests, check them through a trusted channel and report concerns quickly. Exodesk runs ongoing security awareness training with short lessons, phishing simulations and reporting, so your team gets regular practice with less administration for you.
Supporting New Zealand businesses since 1989
What is security awareness training?
Security awareness training helps staff recognise suspicious requests, check them through a trusted channel and report concerns quickly. Exodesk runs ongoing cyber security awareness training for New Zealand businesses, with phishing simulations and practical guidance for everyday work.
The aim is to make safer decisions easier: checking a supplier’s changed bank account, reporting an unexpected login prompt, or questioning a message that appears to come from the boss. Training works alongside your email protection, access controls and payment processes. See what is included.
What does the service include?
We run the security awareness training programme for you. We handle enrolment, reminders, simulations and review of results. You nominate a contact and act on what the results show.
Enrolment and reminders
We enrol your staff, group them by role where that helps, and send the reminders that keep lessons moving.
Short online lessons
Brief lessons on one practical topic at a time, run on a schedule agreed with you when the programme is set up.
Phishing simulations
Controlled exercises that let staff practise recognising and reporting suspicious emails, with scope agreed before they run.
In-person sessions
Face-to-face or live online sessions can be added alongside the online lessons, for example for a team briefing or a finance team.
New-starter induction
New staff are enrolled in an induction module as part of onboarding, so they get the essentials before they handle sensitive requests.
Management reporting
A regular report on completion, reporting and simulation results, with our review of what to focus on next.
What should staff learn?
Start with the situations your staff actually face. Everyone needs to know how to report a suspicious message, use passwords and multi-factor authentication safely, and handle business information.
Security awareness training then adds the scenarios that matter for each role. A familiar name, convincing voice or well-written message is not enough to authorise a payment or release information. Verify unusual requests using contact details you already trust.
Everyday actions
Reporting suspicious emails, texts and calls, using passwords and MFA safely, sharing files with care and handling sensitive information. Phone and text scams sit outside email filtering, so they belong in the training too.
Payment verification
A clear process for checking a changed bank account or an urgent payment request through a channel you already trust, before any money moves.
Backing the pause
Leaders need to support staff who stop and question an unusual request, including one that appears to come from them. Our guide to the leadership role in cyber awareness covers this in more depth.
The essentials first
Who to contact, how to check a payment change and what to do after clicking a suspicious link or approving an unexpected prompt.
For more on the attacks themselves, see our guides to phishing scams and social engineering attacks.
How does delivery work?
Security awareness training runs as an ongoing programme rather than a one-off session, and the scope records what each side does.
Agree the scope
We confirm who is enrolled, the roles that need extra scenarios, how staff report a suspicious message, the boundaries for simulations, who can see individual results and the schedule.
Set up and enrol
We set up the programme, enrol your staff and arrange for new starters to be added as part of onboarding.
Run lessons and simulations
Lessons and phishing simulations run on the agreed schedule, with reminders sent to anyone who has not completed their lessons.
Coach privately
Where a simulation identifies a learning need, follow-up is a short coaching lesson, not a reprimand, and individual results stay with the people you have agreed can see them.
Report and review
We report on completion, reporting and simulation results, and agree what the next round of training should focus on.
Your part is to nominate a contact, confirm the reporting route staff should use, and act on findings that point to a process change, such as how payment changes are approved.
How do phishing simulations fit?
A phishing simulation is a controlled exercise that helps staff practise recognising and reporting suspicious messages. Agree its scope, reporting route and follow-up before it runs.
Use the results to guide coaching and improve processes, without naming and shaming people who make a mistake. A simulation should record what people did, not collect real passwords. Department-level percentages for a small team are not reliable risk rankings, because one person can move the figure a long way.
New Zealand’s National Cyber Security Centre recommends building security awareness through regular campaigns and an easy reporting process, rewarding positive behaviour rather than punishing mistakes so that people do not hide issues.
How do you measure progress?
We report what the programme can measure: who has completed their lessons, how many people report a simulated message and what they did in each exercise. Simulation results add context, but a lower click rate alone does not prove lower risk.
- Completion. Who has finished the lessons assigned to them.
- Simulation reporting. How many recipients report a simulated message.
- Verification habits. Checks discussed with your nominated contact or practised in agreed scenarios, such as verifying a changed bank account.
- Simulation actions. Recorded clicks and other actions, read as counts as well as percentages and in the context of the exercise. In a group of 25, one person changes the result by four percentage points.
Compare results with the difficulty of the message and the people receiving it in mind. A harder lure or a different audience can change the result even when staff are improving. The US National Institute of Standards and Technology developed its Phish Scale for this reason, warning that click rates read on their own can create a false sense of security.
For businesses whose IT we support, our team also reviews the real suspicious messages staff report, and we keep that separate from simulation results.
These are operational indicators. They show how your security awareness training is running, not proof that training alone prevented an incident.
How much does security awareness training cost?
The cost depends on the number of staff, the training format and how much ongoing administration and support is included. Security awareness training from Exodesk is available on its own or as part of our managed IT services, and quoted once the scope is agreed.
- Staff numbers. How many people are enrolled, including roles that need extra scenarios.
- Format. Online lessons only, or online lessons with in-person or live online sessions.
- Simulations. The scope and schedule of phishing simulations.
- Reporting. The level of reporting and review you need.
Your security awareness training quote sets out the included training and simulations, any setup charges, the reporting and review schedule, and any minimum licence numbers or contract term.
Where does training fit?
Security awareness training is one layer. It works best when the technical controls behind it are also in place.
Email security filters messages and checks sender authentication before a person has to decide. Multi-factor authentication adds protection if a password is stolen. A payment-verification process requires unusual requests and changed bank details to be checked through a trusted route before approval. Trained staff then deal with the messages designed to get past those controls.
Training records can also help you answer an insurer’s questions about staff awareness. The requirements depend on your policy and insurer, so keep accurate records of the programme you run, but do not assume that completing training guarantees cover or a claim payment. Our cyber insurance guide explains what insurers look at, and our cyber security services page shows how the pieces fit together.
Why work with Exodesk?
We run it for you
We handle enrolment, reminders, simulations and review of results for your security awareness training, reducing the administration your team needs to manage.
Supportive by design
Private coaching where a simulation identifies a learning need, and a clear reporting route, so staff are encouraged to speak up rather than hide a mistake.
Christchurch and Dunedin
Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide.
Security awareness training questions
What is security awareness training?
Security awareness training helps staff recognise suspicious requests, check them through a trusted channel and report concerns quickly. It runs as an ongoing programme of short lessons and phishing simulations rather than a single session.
Who runs the programme?
Exodesk does. We handle enrolment, reminders, phishing simulations and review of results. You nominate a contact and act on what the results show, such as tightening how payment changes are approved.
How often does security awareness training run?
It runs on a schedule agreed with you when the programme is set up. Short, regular lessons and simulations keep the topic current, and a single annual session is not enough on its own.
Can we buy security awareness training without managed IT?
Yes. The service is available on its own or as part of our managed IT services. Either way, we run the programme and report the results to your nominated contact.
How much does security awareness training cost?
The cost depends on the number of staff, the training format and how much ongoing administration and support is included. We quote once the scope is agreed. Your quote sets out what is included, any setup charges and any minimum licence numbers or contract term.
What happens when staff report a real suspicious email?
For businesses whose IT we support, our team reviews real reports and advises on the next step. Otherwise, reports go to your own IT contact or provider, and the security awareness training shows staff how to make them.
What is a phishing simulation?
A phishing simulation is a controlled exercise that helps staff practise recognising and reporting suspicious messages. Its scope, reporting route and follow-up are agreed before it runs, and the results guide coaching rather than blame.
What affects phishing simulation results?
The difficulty of the message, the people who receive it and changes in how it is delivered all affect the result. A harder lure can raise the click rate even when staff are improving. Read results as counts as well as percentages, especially in a small team.
How do you measure progress?
We report who has completed their lessons, how many people report a simulated message and what they did in each exercise. Verification habits are checked with your nominated contact or practised in agreed scenarios. A lower click rate alone does not prove lower risk.
Should staff be punished for clicking a simulated phishing email?
No. Blame discourages people from reporting real mistakes, which is the behaviour the programme depends on. Follow-up should be private coaching, and reporting a suspicious message should be encouraged.
What should a new starter learn first?
Give new staff the essential reporting and verification instructions as part of onboarding, before they handle sensitive requests. Show them who to contact, how to check a payment change and what to do if they click a suspicious link or approve an unexpected prompt.
Does security awareness training help with cyber insurance?
Training records can help you answer questions from an insurer about staff awareness. The requirements depend on your policy and insurer. Keep accurate records of the programme you run, but do not assume that completing training guarantees cover or a claim payment.
Does training cover phone and text scams?
Yes. Scam calls and text messages arrive outside email filtering, so staff need the same habit for every channel: pause, verify through contact details you already trust and report it.
Can training replace technical security controls?
No. Training works alongside email security, multi-factor authentication and verified payment processes. Each covers a gap the others cannot.
Talk to us about training your team
Talk to Exodesk about security awareness training for your team. We can discuss the risks your staff face and the support you need to run an ongoing programme.
Talk to us about security awareness training
Tell us about your team size, any existing training and the support you need, and we will be in touch to arrange a time that suits.
Prefer to talk?
Christchurch
Level 1, 85 Riccarton Road
Christchurch 8011
03 343 3124
Dunedin
Level 3, Bartons Building
2 Stafford Street, Dunedin 9016
03 479 2941